Describe the bugOn the 4.2.x branch, :spring-security-aspects:compileSpringIoTestJavaAspect is failing.The following is ...

SummaryThis will allow defaulting the HttpSecurity if no instances were createdComment From: ibaskine@rwinch This your f...

Expected BehaviorMaximum age of cookies created by CookieCsrfTokenRepository should be configurable.Current BehaviorCurr...

SummaryStrictHttpFirewall rejects certain patterns in URL paths that might lead to path traversal. This includes double-...

Summary:this is not a bug for sping, but for : https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extens...

Describe the bugSpringSecurityMessageSource.getAccessor() is used in multiple places to set the default message source b...

SummaryShould commence method of CasAuthenticationEntryPoint must be a final method?If the request is from ajax after se...

Hi, I'm watched using check token with /oauth/check_token with basic authorization.curl -X POST --header "Authorization:...

SummaryThe PortResolverImpl.java will resolve to 8080 in case you run http on 8443, thus resulting in wrong behavior.Sin...

SummaryIt is not clear in documentation how to set user authority when are used JSR 250 annotations.Actual Behavior@Rest...

Hello All,I am using Spring Security version 3.2.3.RELEASE and Spring Security Oauth2 version 2.0.9.RELEASEIt seems that...

SInce Version 4.1.1 the authentificationEntryPoints dosent work as expected.I have two authentificationEntryPoints in d...

SummaryWe are using EnableGlobalMethodSecurity with prePostEnabled=true.Actual BehaviorWith spring security 4.1.1.RELEAS...

SummaryThis is a feature request.I am using the security namespace with the element in my spring-security.xml configura...

Hi I am using java based configuration in spring boot. So i am not able to remove a particular url from filte r chain Co...

cemo koc (Migrated from SEC-2799) said:We are migrating our architecture to Spring Boot and we have some issues. I want ...

Arlo O'Keeffe (Migrated from SEC-2550) said:I have an integration test in my application that tests for classloader leak...

Migrated from SEC-2273Comment From: spring-projects-issuesRob Winch said:If this goes in spring-web Spring Security will...

Expected BehaviorWhen handling exceptions like LockedException in an AuthenticationFailureHandler, have the UserDetails ...

public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { http. ... ...